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AMKNDMEWTS TO THE CLAIMS 

This listing of the claims will replace all prior versions and listing of the claims. 

Listing of the Claims : 

1. (Currently amended) A fimction randomness evaluating apparatus for a data 
Micryption device comprising: 

ii^nit means for inputting digital signals representing candidate functions S(x) of S-box to 
be evaluated, input difference value Ax and output mask values Ty, and storing them in storage 
means; 

differential-linear-cryptanalysis resistance evaluating means for: counting, fo r every aU 
sets of input difference value Ax except 0 and output mask vahie ryexcqjtO of each of the 
functions S(x)_read out of the storage means, a number of inputs values x for which the inner 
product of (S(x)+S(x+Ax)) and said ou^t mask value Ty is l,,„as expr^sa^ bvthe following 
equation: 

^s(Ax,ry)= |2x#{x e GF(2r|(S(x)+S(x + ^^^ 
determining a maximum value 5 am or^p the results of counting; 

evaluating the resistance of said function to said differential-l inear crvptanalvsis based on 
said maximum value 5: and 

output means for outputting an output digital signal repre senting an evaluation result 

and evaluating tho rofliotonoo of oaid function to diffbr e ntifll - linoor oryptonolysifl boood on 
th e result of gold number, and 

output moono for outputting on output digital signal r e proaonting an ovoluation reault. 
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2. Canceled 

3. (Currently amended) The function randonmess evaluating apparatus of claim 1-of 
further comprising at least one of: 

differential.cryptanalysis resistance evaluating means for calculating, for the function 
S(x) to be evaluated, the number of input values x that satisfy S(x)+ S(x+Ax)=Ay for every set 
(Ax. Ay) and evaluating the resistance of said function to differential cryptanalysis based on the 
result of said calculation; and 

linear^;ryptanalysis resistance evaluating means for calculating, for the function to be 
evaluated, the number of input values x for which the inner product of the input value x and its 
mask value Fx is equal to the inner product of a function output value S(x) and its mask value Fy 
and evaluating the resistance of said function to linear cryptanalysis based on the result of said 
calculation. 

4. Canceled 

5. Canceled 

6. (Previously presented) A random fimction generating apparatus for a data 
encryption device comprising: 

input means for inputting digital signals representing parameter values of each of a 
plurality of functions of diffeient algeraic structures and storing them in storage means; 

3 
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candidate function generating means for generating candidate functions each formed by a 
combination of said plurality of (unctions of different algebraic structures based on said pluraUty 
of parameters read out of the storage means; 

resistance evaluating means for evaluating the resistance of each of said candidate 
functions to a cryptanalysis; and 

selecting means for selecting those of said resistance-evaluated candidate functions which 
are highly resistant to said cryptanalysis and outputting digital signals representing selected ones 
of said resistance-evaluated candidate functions; 

wherein one of said plurality of functions of different algebraic structures is resistant to 
each of differential cryptanalysis and linear cryptanalysis. 

7. Canceled 

8, (Previously presented) The random function generating apparatus of claim 6, 
wherein said input means is adapted to input digital signals representing input difference values 
Ax and output mask values Fy and storing tiiem in the storage means, and said resistance 
evaluating means comprises at least one of: 

higher-order-differential cryptanalysis resistance evaluating means for: calculating a 
minimum value of the degree of a Boolean polynomial for input bits by which ou^ut bits of eac b 
of said candidate functions are expressed; and evaluating the resistance of said each candidate 
function to higher order cryptanalysis based on the result of said calculation; 

interpolation-cryptanalysis resistance evaluating means for expressing an output value y 
as y = fic(x) for an input value X and a fixed key k using a polynomial over Galois field which is 
composed of elements equal to a prime p or a power of said prime p; coxmting a number of terms 
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of said polynomial; and evaluating the resistance of said each candidate function to interpolation 
cryptanalysis based on the result of said niunber, 

partitioning-cryptanalysis resistance evaluating means for: dividing all input values of the 
ftinction to be evaluated and ihe corresponding output values into input subsets and output 
subsets; calculating an imbalance of the relationships between ihe input subset and the output 
subset with respect to their average corresponding relationship; and evaluating the resistance of 
said fimction to partitioning cryptanalysis based on the result of said calculation; and 

differenlial-linear cryptanalysis resistance evaluating means for: calculating, for every set 
of input difference value Ax and output mask value Fy of the function S(x) to be evaluated, a 
number of input values x for which the inner product of (S(x)+S(x+Ax)) and said output mask 
value ry is 1 ; and evaluating the resistance of said function to differential-linear cryptanalysis 
based on the result of said calculation. 



9. (Cunently amended) A method for evaluating the randomness of the input/output 
relationship of a fimction for data encryption, said method comprising: 

ii^utting digital signals representing candidate fimctions S(x) of S-box to be evaluated, 
input difference values Ax and output mask values Fy, and storing them in storage means; 

a differential-linear cryptanalysis resistance evaluating step of: counting, for every set of 
input difference value A x except 0 and output mask value F v except 0 of each of the fimctions 
S(x) read out of flie storage means, a number of input values x for which an inner product of 
(S(x>+-S(x+Ax)) and said ouQ)ut mask value Fy is 1 . as expressed by the fo llowing equation: 



^s(Ax.ry) = 2x#{x € GF(2)° (S(x) + S(x + Ax) • Fy = 1} - 2 



determining a maximum value 5 among the resul ts of counting: 
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^vains.rii, p the resistance of said functi o n tn fiaid differential-linear cryptan^vsis using 
§aid maxiip tim value H: and 

mitpiittin ^ an oatput digital signa l representing an evaluation result 

i a n d ovalUQtinE r ocifl t nn pii of rf"--< fi-""^''"" HiffArmritin.1 lin e nr civmonolvoiQ bosod on 
fee to s u l t of goid number; and 

outputting on oulput digital aignnl roprooonting an ovoluation rooult. 



10. Canceled 



1 1 . (Currently amended) The randomness evaluating method of any one of claim 9, 
40j 35 or 36, further comprising at least one of; 

(d) a diffeiential-cryptanalysis resistance evaluating step of: calculating the number of 
input values x that satisfy S(x)+ S(x+Ax)=Ay for every set (Ax, Ay) except Ax=0; and evaluiating 
the resistance of said fUnction to differential ciyptanalysis based on the result of said calculation; 
and 

(e) a linear-cryptanalysb resistance evaluating means for calculating, for said Ainction 
S(x), the number of input values x for which the inner product of the input value x and its mask 
value He is equal to the inner product of a function output value S(x) and its mask value Fy and 
evaluating the resistance of said fimction to linear cryptanalysis based on the result of said 
calculation. 



12. Canceled 
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13. (Cunwtly amended) A random function generating method for data encryption 
comprising the steps of: 

(o) inputting digital signals representing input difference values Ax, output mask values 
ry and parameter values of each of a plui^ity of functions of different algebraic structures and 
storing them in storage means; 

(a) setting various input values read out of the storage means for each of candidate 
functions S(x) of S-box and calculating output values corresponding to said various input values 
x; 

(b) storing the output values in storage means; and 

(c) evaluating the resistance of each of said candidate functions to a cryptanalysis based 
on the output values stored in said storage means, and selectively outputting candidate function 
highly resistant to said cryptanalysis; and 

wherein said step (c) comprising; 

(c-l) a higher-order cryptanalysis resistance evaluating step of: calculating a minimum 
value of the degree of a Boolean polynomial for input bits of each of said candidate functions by 
which its output bits are expressed; evaluating the resistance of said each candidate fimction to 
higher order cryptanalysis based on the result of said calculation; and leaving those of said 
candidate functions whose resistance is higher than a predeteraiined first reference and 
discarding the others; 

(c-2) a differential-linear cryptanalysis resistance evaluating step of: calculating, for 
every set of input difference value Ax and output mask value Ty of each candidate function S(x), 
a number of input values x for which the inner product of (S(x)+S(x+Ax)) and said output mask 
value Ty is 1; evaluating resistance of said function to differential-linear cryptanalysis based on 
the result of said calculation; and leaving those of said candidate functions whose resistance is 
higjier than a predetermined second reference and discarding the others; 
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(c-3) a partitionm8.cryptanalysis resistance evaluating step of: dividing all input values 
of each candidate fiinction and the corresponding output values into input subsets and output 
subsets; calculating an imbalance of the relationship between the input subset and the output 
subset with respect to their average corresponding relationship; evaluating the resistance of said 
each candidate function to said partitioning cryptanalysis based on the result of said calculation; 
and leaving those of said candidate fiinctions whose resistance is higher than a predetemined 
third reference and discarding the others; and 

(c.4) an inteipolation-cryptanalysis resistance evaluating step of: expressing an output 
value y as y = ^(x) for an input value x and a fixed key k using a polynomial over Galois field 
which is composed of elements equal to a prime p or a power of said prime p; counting a number 
of terms of said polynomial; evaluating the resistance of said function to interpolation 
cryptanalysis; and leaving those of said candidate functions whose resistance is higher than a 
predetermined fourth reference and discarding the others- 

wherein said candidate functions are each a composite fiinction composed of at least one 
function resistant to said diffef«ntial crvntaT ialvsis and said linear cryptanalysis and at lea$t one 
fiinction of an algebraic structure different from that of said at least one function. 



14. (Previously presented) The random function generating metiiod of claim 13, 
wherein: 

said differential-linear.cryptanalysis resistance evaluating step (c.2) includes a step of^ 
calculating the following equation for every set of said input difference value Ax except 0 and 
said output mask value Fy except 0 

^s(Ax.ry)= 2x#{x e GF(2)"l(S(x) + S(x + Ax))«ry = 1}-2''|; 
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calculating a maximum value S among the calculation results; and evaluating the 
resistance of said candidate function to said differential-linear cryptanalysis based on said 
maximum value H; and 

said partitioning cryptanalysis resistance evaluating step (3) includes a step of dividing an 
input value set F and an output value set G of said fimction into u input subsets (Fo, Fi, . . ., Fu-i} 

and V output subsets {Go,G| Gv-i}; for each partition-pair (Fi,Gi)(i = 0. „.,u-l; j = 0, 1 

v-1), calculating a maximum one of probabilities that all output values y coiresponding to all 
input values x of the input subset Fi belong to the respective output subsets G, 0 = 0,..-, v-1); 
calculating a measure Is(F, G) of an average imbalance of a partition-pair (F. G) based on all 
maximum values calculated for all partition pairs; and evaluating the resistance of said candidate 
function to said partitioning cryptanalysis based on said measure. 



15. (Original) The random function generating method of claim 13 or 14, wherein: 

said step (c-1) includes a step of: when no candidate fimction remains undiscanded, 
easing the candidate fimction selecting condition by changing said first reference by a first 
predetermined width, and executing again the evaluation and selecting process; 

said step (c-2) includes a step of: when no candidate fimction remains undiscarded, 
easing the candidate function selecting condition by changing said second reference by a second 
predetermined width, and executing again the evaluation and selecting process; 

said step (c-3) includes a step of: when no candidate fimction remains undiscarded, 
easing the candidate function selecting condition by changing said third reference by a third 
predetermined width, and executing again flie evaluation and selecting process; and 

said step (c-4) includes a step of; when no candidate function remains undiscarded. 
easing the candidate fimction selecting condition by changing said fourth reference by a fourth 
predetermined widfli, and executing again the evaluation and selecting process. 
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16. (Previously presented) The random function generating meliiod of claim 13 or 
14, further comprising: 

(c-5) a diffeiential-cryptanalysis resistance evaluating step of: calculating, for each 
candidate function S(x). the number of inputs x that satisfy S(x)+ S(x+Ax)-Ay for every set (Ax. 
Ay) except Ax=0; evaluating the resistance of said each candidate function to differential 
cryptanalysis based on the result of said calculation; and leaving those of said candidate 
functions whose resistance is higher than a predetermined fifth reference and discarding the 
others before said step (c-2); and 

(c-6) a linear-cryptanalysis resistance evaluating step of: calculating, for each candidate 
function, the number of input values x for which the inner product of the input value x and its 
mask value Fx is equal to the inner product of a function output value S(x) and its mask value 
Fy, evaluating the resistance of said each candidate function to linear cryptanalysis based on the 
result of said calculation; and leaving those of said candidate functions whose resistance is 
higher than a predetermined sixth reference and discarding the others after said step (c-5). 



17. Canceled 



1 8. (Previously presented) The random fimction generating method of claim 1 6, 
wherein: 

said step (c-5) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said fifth reference by a fifWi 
predetermined width, and executing again the evaluation and selecting process; and 
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said step {06) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said sixth reference by a sixth 
predetermined width, and executing again the evaluation and selectmg process. 



19. Canceled 

20. (Currently amended) A recording medium having recorded thereon a random 
function generating method for data encryption as a computer program, said program comprising 
the steps of: 

(a) setting various values as each parameter for candidate functions S(x) and calculating 
output values corresponding to various input values; 

(b) storing the output values in storage means; and 

(c) evaluating resistance of each of said candidate functions to a cryptanalysis based on 
the output values stored in said storage means, and selectively outputting candidate function 
highly resistant to said cryptanalysis; and 

wherein said step (c) comprises: 

(c-1) a higher-order cryptanalysis resistance evaluating step of: calculating a minimum 
value of the degree of a Boolean polynomial for input bits of each of said candidate functions by 
which its output bits are expressed; evaluating the resistance of said each candidate function to 
higher order cryptanalysis based on the result of said calculation; and leaving those of said 
candidate functions whose resistance is higher than a predetermined first reference and 
discarding the others; 



U 
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(c-2) a differential-linear cryptanalysis resistance evaluating step of: calculating, for 
every set of input difference value Ax and output mask value Ty of each candidate ftmction S(x), 
a number of input values x for which the inner product of (S(x>^-S(x+Ax)) and said output mask 
value ry is 1; evaluating resistance of said function to differential-linear cryptanalysis based on 
the result of said calculation; and leaving those of said candidate functions whose resistance is 
higher than a predetermined second reference and discarding the otfiers; 

(c-3) a partitioning-cryptanalysis resistance evaluating step of: dividing all input values 
of each candidate fimction and the corresponding output values into input subsets and output 
subsets; calculating an imbalance of the relationship between the input subset and the output 
subset witii respect to tiieir average corresponding relationship; evaluating tfie resistance of said 
each candidate function to said partitioning cryptanalysis based on the result of said calculation; 
and leaving those of said candidate functions whose resistance is higher than a predetermined 
third reference and discarding the others; and 

(c-4) an interpolation-cryptanalysis resistance evaluating step of: expressing an output 
value y as y = fk(x) for an input value x and a fixed key k using a polynomial over Galois field 
which is composed of elements equal to a prime p or a power of said prime p; countmg a number 
of temis of said polynomial; evaluating tiie resistance of said function to interpolation 
cryptanalysis; and leaving those of said candidate fimctions whose resistance is higher than a 
predetermined fourth reference and discarding the others; 

wherein said candidate fimctions are each a cfttnpnsite function composed of at least one 
fimction resistant to said difTerential crvptanalvsis a nd said linear crvntanalvsis and at least one 
function of an algebraic structure different from that of said at least one function. 
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21. (Previously presented) The recording medium of claim 20, wherein: 

said differential-linear-cryptanalysis resistance evaluating step (c-2) includes a step of: 
calculating the following equation for every set of said input difference Ax except 0 and said 
output mask value Fy except 0 

^s(^.ry) = |2x#{x e GF(2)»|(S(x) + S(x + Ax)) •Fy = 1} - 2°| ; 

calculating a maximum value S among the calculation resuKs; and evaluating the 
resistance of said candidate function to said differential-linear cryptanalysis based on said 
maximum value S; and 

said partitioning cryptanalysis resistance evaluating step (3) includes a step of dividing an 
input value set F and an output value set G of said function into u input subsets {Fo, Fi, Fu-i} 
and V output subsets {Go, Gu ..:,Gv.i}; for each partition-pair (Fi,Gi)(i = 0, ...»u-l;j=0, 1, .... 
v-1), calculating a maximum one of probabilities that aU output values y corresponding to all 
input values x of the input subset Fi belong to the respective output subsets Gj 0 = 0, . . . , v-1); 
calculating a measure Is(F, G) of an average imbalance of a partition-pair (F, G) based on aU 
maximum values calculated for all partition pairs; and evaluating the resistance of said candidate 
function to said partitioning cryptanalysis based on said measure. 



22. (Original) Theiecoidingmediumofclaim20or 21, wherein: 

said step (c-1) iiicludes a step of: when no candidate function reinains undiscarded, 
easing the candidate function selecting condition by changing said first reference by a fust 
predetermined width, and executing again the evaluation and selecting process; 

said step (c-2) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said second reference by a second 
predetermined width, and executing again the evaluation and selecting process; 

13 
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said step (c-3) includes a step of: when no candidate function remains undiscarded, 
easing the candidate fiinction selecting condition by changing said third reference by a third 
predetermined width, and executing again the evaluation and selecting process; and 

said step (c-4) includes a step of: when no candidate fiinction remains undiscarded, 
easing the candidate function selecting condition by changing said fourth reference by a fourth 
predetermined width, and executing again the evaluation and selecting process. 



23. (Previously presented) Therecordingmedinmof claim 20 or 21, wherein said 
program includesat least one of: 

(c-5) a diffeiential-ciyptanalysis resistance evaluating step of. calculating, for each 
candidate fimction S(x). the number of inputs x that satisfy S(x)+ S(x+Ax)=Ay for every set (Ax, 
Ay) except Ax=0; evaluating the resistance of said each candidate fimction to differential 
cryptanalysis based on the result of said calculation; and leaving those of said candidate 
functions whose resistance is higher than a predetermined fifUi reference and discarding the 
odiers before said step (c-2); and 

(c-6) a linear-cryptanalysis resistance evaluating step of: calculating, for each candidate 
function, the number of input values x for which the inner product of the input value x and its 
mask value Fx is equal to the inner product of a function output value S(x) and its mask value 
Ty; evaluating the resistance of said each candidate fimction to linear cryptanalysis based on the 
result of said calculation; and leaving those of said candidate functions whose resistance is 
higher than a predetermined sixth reference and discarding the others after step (c-5). 



24. Canceled 
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25. (Previously presented) Therecordingmediumof claim 23, wherein: 

said step (c-5) includes a step of: when no candidate function remains undiscarded, 
easing the candidate fimction selecting condition by changing said fifth reference by a fifth 
predetermined width, and executing again the evaluation and selecting process; and 

said step (c-6) includes a step of: when no candidate function remains undiscarded, 
easing the candidate function selecting condition by changing said sixth reference by a sixth 
predetermined width, and executing again the evaluation and selecting process. 



26. Canceled 



27. (Currently amended) A recording medium having recorded thereon as a program 
a method for evaluating the landonmess of the input/output relationship of a fimction for data 
encryption, said program comprising: 

(a) a differential-linear cryptanalysis resistance evaluating step of: calculating, for every 
set of input difference value A x except 0 and output mask value Fv except 0 of a function S(x) to 
be evaluated, a number of input values x for which the inner product of {S(x>4-S(x+Ax)) and said 
output mask value Fy is 1 . as expressed by the following equation: 

^s(Ax,ry)= 2x#{x eGF(2)'^|(S(x) + S(x + Ax).ry = l}-2" 



determining a wmyiTj^^it n value 3 among the r esults of counting: 

evaluating the resistance of said fimction to said diflTerential-lin ear crvntanalvsis using 
said maximum value S: and 

outputting an outnut digital signal representing an evaluation result 
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. m il l o T n li intin £ rnni i t nnr r rf'-^^ fl.T,n*in« tn .l iffhrflntial Imoor orvptunalvaiD basod on the - 
e f tho Qflid oolcttlation. 



28. Canceled 



29. (Cunently amended) The recording medium of claim 27-erf», said program 
further comprising at least one of: 

(e) a differential-cryptanalysis resistance evaluating step of: calculating a number of input 
values X that satisfy S(x>f S(x+Ax)-Ay for every set (Ax, Ay) except Ax=0; and evaluating the 
resistance of said function to differential cryptanalysis based on the result of said calculation; and 

(f) a linear-cryptanalysis resistance evaluating means for calculating, for said function 
S(x), the number of input values x for which the inner product of the input value x and its mask 
value Fx is equal to the inner product of a ftmction ou^ut value S(x) and its mask value Vy and 
evaluating the resistance of said function to linear cryptanalysis based on the result of said 
calculation. 



30. Canceled 



31. (Previously presented) The random function generating method of claim 15, 
wherein said candidate fimctions are each a composite flmction composed of at least one 
function resistant to said diffo-ential cryptanalysis and said linear cryptanalysis and at least one 
function of an algd}raic structure different firom that of said at least one function. 
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32. (Previously presented) The recording medium of 22, wherein said candidate 
functions are each a composite fimction composed of at least one function resistant to said 
differential cryptanalysis and said linear cryptanalysis and at least one function of an algebraic 
structure different from that of said at least one ftmction. 



33. (Currently amended) The fimction randomness evaluating apparatus of claim l-er 
3, fhrdier comprising at least one of: 

higher-oider*differential cryptanalysis resistance evaluating means for calculating a 
minimum value of the degree of a Boolean polynomial for input bits by which output bits of the 
function to be evaluated are expressed, and evaluating that larger said minimum value, higher 
the resistance of said function to higher order differential cryptanalysis is; 

inteipolation-cryptanalysis resistance evaluating means fori expressing an output value y 
as y ■» fk(x) for an input value x and a fixed key k using a polynomial over Galois field which is 
composed of elements equal to a prime p or a power of said prime p; counting a number of terms 
of said polynomial; and evaluating die resistance of said function to interpolation cryptanalysis 
based on the result of said number and 

partitioning-cryptanalysis resistance evaluating means for: dividing all ii^iuts values of 
the fimction to be evaluated and the corresponding output values into Input subsets and output 
subsets; calculating an imbalance of the relationship between the input subset and the output 
subset with respect to their average corresponding relationship; and evaluating the resistance of 
said function to partitioning cryptanalysis based on the result of said calculation. 
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34, (Previously presented) The function randomness evaluating apparatus of claim 
33, wherein: 

said partitioning-cryptanalysis resistance evaluating means is means for: dividing an 
input value set F and an output value set G of said function into u input subsets {Fo, Fi , . . . , Ffu-i } 

and V output subsets {Go, Gi G^i}; for each partition-pair (Fi. GO (i = 0 u-1; j = 0, 1. .... 

v-lX calculating a maximum one of probabiUties that all output value y corresponding to all 
input values x of the input subset Fj belong to the respective output subsets Gj C = 0. . . v-1); 
calculating a measure Is(F, G) of an average imbalance of a partition-pair (F, G) based on all 
maximum values calculated for all partition pairs; and evaluating the resistance of said function 
to said partitioning cryptanalysis based on said measure. 



35. (Currently amended) The randomness evaluating metiiod of claim 9 or 10 > further 
comprising at least one of: 

(a) a higher-order-differential cryptanalysis resistance evaluating step of: calculating a 
minimum value of the degree of a Boolean polynomial for input bits of said function S(x) by 
which its output bits are expressed; and evaluating the resistance of said function to higher order 
cryptanalysis based on the result of said calculation; 

(b) a partitioning-cryptanalysis resistance evaluating step of: dividing all input values of 
the function to be evaluated and the corresponding output values into input subsets and output 
subsets; calculating an imbalance of the relationship) between the input subset and the output 
subset with respect to their average corresponding relationships; and evaluating the resistance of 
said function to partitioning cryptanalysis based on the result of said calculation; and 

(c) an interpolation-cryptanalysis resistance evaluating step of: expressing an output 
value y as y = fk(x) for an input value x and a fixed key k using a polynomial over Galois field 
which is composed of elements equal to a prime p or a power of said prime p; counting a number 
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of terms of said polynomial; and evaluating the resistance of said function to interpolation 
cryptanalysis. 

36. (Previously presented) The randomness evaluating method of claim 35, wherein: 

said paititioning-cryptanalysis resistance evaluating step (b) is a step of: dividing an input 
value set F and an output value set G of said function into u input subsets {Fo,Fu ...,Fu.i} andv 
output subsets {Go. Gu Gy.i}; for each partition-pair (Fi, Gi) (i = 0, u-1; j = 0, 1, v-1), 
calculating a maximum one of probabilities that all output values y corresponding to all mput 
values X of the input subset Fi belong to the respective output subsets Gj (j = 0, -- v-1); 
calculating a measure Is(F, G) of an average imbalance of a partition-pair (F, G) based on all 
maximum values calculated for all partition pairs; and evaluating the resistance of said function 
to said partitioning cryptanalysis based on said measure. 

37. (Currently amended) The recording medium of claim 27 or 2 8» further 
comprising at least one of: 

(b) a higher-order-difFerential cryptanalysis resistance evaluating step of: calculating a 
minimum value of the degree of a Boolean polynomial for input bits of said function S(x) by 
which its output bits are expressed; and evaluating the resistance of said function to higher order 
cryptanalysis based on the result of said calculation; 

(c) a partitioning-cryptanalysis resistance evaluating step of; dividing all input values of 
the function to be evaluated and the corresponding outputs into input subsets and output subsets; 
calculating an unbalance of the relationships between the input subset and the output subset with 
respect to their average corresponding relationship; and evaluating the resistance of said function 
to partitioning cryptanalysis based on the result of said calculation; and 
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(d) an inteipolation-cryptanalysis resistance evaluating step of: expressing an output 
value y as y = fi.(x) for an input value x and a fixed key k using a polynomial over Galois field 
which is composed of elements equal to a prime p or a power of said prime p; counting a number 
of terms of said polynomial; and evaluating the resistance of said funcUon to interpolation 
cryptanalysis. 



38. (Previously presented) The recording medium of claim 37, whwein: 

said partitioning-cryptanalysis resistance evaluating st^ (c) is a step of: dividing an input 

value set F and an output value set G of said function into u input subsets {Fo, Fi F«-j} and v 

output subsets {Go, Gi, .. ., Gy-i}; for each partition-pair (F„ GO (i = 0, .... u-1; j « 0, 1, v-1), 
calculating a maximum one of probabilities that all output values y corresponding to all input 

values X of the ii^ut subset Fj belong to the respective output subsets Gj (j = 0 v-l), 

calculating a measure Is(F, G) of an average imbalance of a partition-pair (F, G) based on all 
maximum values calculated for all partition pairs; and evaluating the resistance of said function 
to said partitioning cryptanalysis based on said measure. 
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